JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.48.251.3

20.48.251.3 was found in our database!

This IP was reported 336 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.48.251.3

Whois 20.48.251.3

IP Abuse Reports for 20.48.251.3:

This IP address has been reported a total of 336 times from 262 distinct sources. 20.48.251.3 was first reported on August 26th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 ISPLtd	2026-08-26 22:45:03 (1 hour ago)	20.48.251.3 [26/Aug/2026:19:45:01 -0300] gloria.target.domain:80 URL:/wp-content/plugins/hellopress/ ... show more 20.48.251.3 [26/Aug/2026:19:45:01 -0300] gloria.target.domain:80 URL:/wp-content/plugins/hellopress/wp_filemanager.php "GET /wp-content/plugins/hellopress/wp_filemanager.php 20.48.251.3 [26/Aug/2026:19:45:02 -0300] gloria.target.domain:80 URL:/dragonshell.php "GET /dragonshell.php ... show less	Hacking Web App Attack
🇩🇪 Céline	2026-08-26 22:34:22 (2 hours ago)	Shield Guard: Blocklist: IP signalée (blocklist_de) \| Scanner: empty (+70)	Web App Attack
🇩🇪 varlet	2026-08-26 22:26:42 (2 hours ago)	Detected by CrowdSec; scenario=crowdsecurity/http-wordpress-scan	Web App Attack
🇺🇸 Som1ght3n	2026-08-26 22:12:03 (2 hours ago)	This IP attempted to exploit a WordPress plugin vulnerability by requesting '/wp-content/plugins/hel ... show more This IP attempted to exploit a WordPress plugin vulnerability by requesting '/wp-content/plugins/hellopress/wp_filemanager.php'. show less	Web App Attack
🇺🇸 SX Communications	2026-08-26 22:08:48 (2 hours ago)	Web vulnerability scanning / probing from 20.48.251.3: automated requests for CMS admin paths, login ... show more Web vulnerability scanning / probing from 20.48.251.3: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 6 hits; paths: /abcd.php, /greem_res.php, /privacy.php, /v3.php, /wo.php. show less	Port Scan Hacking Web App Attack
🇫🇮 kumiko	2026-08-26 22:08:09 (2 hours ago)	[2026-08-27 01:08:08] Apache auth failure: brute force attempt, file probing	Brute-Force Bad Web Bot
🇫🇮 albionfreemarket.com	2026-08-26 22:03:06 (2 hours ago)	20.48.251.3 - - [26/Aug/2026:22:03:05 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.48.251.3 - - [26/Aug/2026:22:03:05 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/2.0" 403 153 "-" "-" 0.000 "-" "CA" 20.48.251.3 - - [26/Aug/2026:22:03:05 +0000] "GET /this_is_a_new_hello_world.php HTTP/2.0" 403 153 "-" "-" 0.000 "-" "CA" ... show less	Bad Web Bot Web App Attack
🇺🇸 Epimetheus	2026-08-26 21:58:33 (2 hours ago)	Unauthorized access attempts: [GET] /samll.php [GET] /v3.php [GET] /_js.jpg..bk.php [GET] /wo.php [ ... show more Unauthorized access attempts: [GET] /samll.php [GET] /v3.php [GET] /_js.jpg..bk.php [GET] /wo.php [GET] /verox.php [GET] /themes.php UA: Unknown show less	Web App Attack
Anonymous	2026-08-26 21:55:52 (2 hours ago)	20.48.251.3 - - [27/Aug/2026:05:55:50 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.php ... show more 20.48.251.3 - - [27/Aug/2026:05:55:50 +0800] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 196 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:50 +0800] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 16 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:50 +0800] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 16 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:51 +0800] "GET /or.php HTTP/1.1" 404 16 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:51 +0800] "GET /or.php HTTP/1.1" 404 16 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:51 +0800] "GET /verox.php HTTP/1.1" 404 16 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:51 +0800] "GET /verox.php HTTP/1.1" 404 16 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:51 +0800] "GET /BDKR28WP.php HTTP/1.1" 404 16 "-" "-" 20.48.251.3 - - [27/Aug/2026:05:55:51 +0800] "GET /BDKR28WP.php HTTP/1.1" 404 16 "-" "-" ... show less	Bad Web Bot Web App Attack
🇫🇮 Christopher Hughes	2026-08-26 21:55:45 (2 hours ago)	[Wed Aug 26 22:55:43.685775 2026] [proxy_fcgi:error] [pid 3325417:tid 140112629327424] [client 20.48 ... show more [Wed Aug 26 22:55:43.685775 2026] [proxy_fcgi:error] [pid 3325417:tid 140112629327424] [client 20.48.251.3:61732] AH01071: Got error 'Primary script unknown' [Wed Aug 26 22:55:43.942686 2026] [proxy_fcgi:error] [pid 3325417:tid 140112595756608] [client 20.48.251.3:61732] AH01071: Got error 'Primary script unknown' [Wed Aug 26 22:55:44.201125 2026] [proxy_fcgi:error] [pid 3325417:tid 140113703069248] [client 20.48.251.3:61732] AH01071: Got error 'Primary script unknown' [Wed Aug 26 22:55:44.458450 2026] [proxy_fcgi:error] [pid 3325417:tid 140113141020224] [client 20.48.251.3:61732] AH01071: Got error 'Primary script unknown' [Wed Aug 26 22:55:44.716313 2026] [proxy_fcgi:error] [pid 3325417:tid 140113686283840] [client 20.48.251.3:61732] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
Anonymous	2026-08-26 21:53:49 (2 hours ago)	WordPress/Woo probe	Web App Attack
🇦🇺 paulshipley.com.au	2026-08-26 21:50:50 (2 hours ago)	dlcarterauthor.com:443 20.48.251.3 - - [27/Aug/2026:07:50:49 +1000] "GET /themes.php HTTP/1.1" 404 6 ... show more dlcarterauthor.com:443 20.48.251.3 - - [27/Aug/2026:07:50:49 +1000] "GET /themes.php HTTP/1.1" 404 68096 "-" "-" ... show less	Web App Attack
Anonymous	2026-08-26 21:42:36 (2 hours ago)	Automatically blocked after 6 security events. Observed repeated web application attack probes. Sour ... show more Automatically blocked after 6 security events. Observed repeated web application attack probes. Source: Cloudflare security controls. show less	Hacking Web App Attack
🇩🇪 TheDjRider	2026-08-26 21:41:12 (3 hours ago)	CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ba ... show more CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ban triggered. Detection time (UTC): 2026-08-26T21:40:34.005802137Z. Context: http_status=404, http_status=403 show less	Web App Attack
🇺🇸 alecj.com	2026-08-26 21:40:30 (3 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking

Showing 1 to 15 of 336 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇬 197.52.25.61

🇲🇽 177.238.210.65

🇵🇭 49.149.142.64

🇺🇸 20.42.119.196

🇮🇶 5.175.146.161

🇫🇷 2a01:cb1d:8c24:b300:46a:3312:fc6f:9cb4

🇻🇪 201.242.144.92

🇿🇦 197.184.169.159

🇧🇷 138.94.161.192

🇻🇳 116.99.252.203

🇺🇸 104.152.52.139

🇬🇧 90.201.48.165

🇫🇷 83.195.23.60

🇬🇧 82.32.43.4

🇫🇷 77.131.124.9

🇺🇸 72.244.47.243

🇱🇹 62.60.130.242

🇧🇷 45.236.139.91

🇳🇱 45.148.10.151

🇺🇸 45.78.94.104